Subprocessors
Compliance
Complete legal, privacy, and compliance policies
Subprocessors
Effective Date: June 18, 2025
Last Updated: June 18, 2025
Introduction
This document lists all subprocessors that PopHop Technologies, Inc. ("PopHop") uses to process personal data on behalf of our customers. This list is maintained in accordance with our Data Processing Agreement and applicable data protection laws including GDPR, CCPA, and other privacy regulations.
What is a Subprocessor? A subprocessor is a third-party service provider that PopHop engages to process personal data on behalf of our customers. All subprocessors are contractually obligated to maintain appropriate security measures and data protection standards.
Contact Information: PopHop Technologies, Inc.
2648 International Boulevard Ste 115 #1108
Oakland, CA 94601, US
Email: legal@pophopmail.us
Current Subprocessors
Core Infrastructure and Hosting
Vercel Inc.
- Location: San Francisco, California, United States
- Service Purpose: Web hosting, content delivery, and platform infrastructure
- Data Processing: Website hosting, static content delivery, platform performance optimization
- Privacy Contact: privacy@vercel.com
- Website: https://vercel.com
- Data Location: United States
- Certifications: SOC 2 Type II compliant
Supabase, Inc.
- Location: San Francisco, California, United States
- Service Purpose: Database hosting and real-time platform services
- Data Processing: User data storage, real-time messaging, authentication services
- Privacy Contact: privacy@supabase.com
- Website: https://supabase.com
- Data Location: United States
- Certifications: SOC 2 Type II compliant
Cloudflare, Inc.
- Address: 101 Townsend Street, San Francisco, CA 94107, United States
- Service Purpose: Content delivery network (CDN) and security services
- Data Processing: Website performance optimization, security threat protection, traffic routing
- Privacy Contact: privacyquestions@cloudflare.com
- Website: https://www.cloudflare.com
- Data Location: Global (with data residency controls)
- Certifications: ISO 27001, SOC 2 Type II
Payment Processing
Stripe, Inc.
- Address: 510 Townsend Street, San Francisco, CA 94103, United States
- Service Purpose: Payment processing, billing, and financial transaction management
- Data Processing: Payment card information, billing addresses, transaction records, payout processing
- Privacy Contact: dpo@stripe.com
- Website: https://stripe.com
- Data Location: United States (with global processing capabilities)
- Certifications: PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II, ISO 27001
Communication and Support
Intercom, Inc.
- Address: 55 2nd Street, San Francisco, CA 94105, United States
- Service Purpose: Customer support, chat services, and user communication
- Data Processing: Support conversations, user interaction data, help desk functionality
- Privacy Contact: privacy@intercom.com
- Website: https://www.intercom.com
- Data Location: United States and Ireland
- Certifications: SOC 2 Type II, ISO 27001
Loops
- Service Purpose: Marketing email campaigns and newsletter automation
- Data Processing: Email addresses, marketing preferences, campaign engagement data
- Privacy Contact: privacy@loops.so
- Website: https://loops.so
- Data Location: United States
- Certifications: GDPR compliant
Resend
- Service Purpose: Transactional email delivery and notification services
- Data Processing: Email addresses, transactional email content, delivery analytics
- Privacy Contact: privacy@resend.com
- Website: https://resend.com
- Data Location: United States
- Certifications: GDPR compliant
Analytics and Performance
Google LLC
- Address: 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States
- Service Purpose: Website analytics and performance monitoring
- Data Processing: Website usage data, user interaction analytics, performance metrics
- Privacy Contact: privacy@google.com
- Website: https://www.google.com
- Data Location: United States (with global processing)
- Certifications: ISO 27001, SOC 2 Type II
- Services Used: Google Analytics
Planned Future Subprocessors
The following subprocessors are planned for integration into PopHop's platform. Customers will receive 30 days' advance notice before these subprocessors are implemented, as required by our Data Processing Agreement.
Workflow Automation (Version 2)
Zapier, Inc.
- Address: 548 Market Street, Suite 62411, San Francisco, CA 94104, United States
- Service Purpose: Workflow automation and third-party app integrations
- Data Processing: User workflow data, integration configurations, automated task execution
- Privacy Contact: privacy@zapier.com
- Website: https://zapier.com
- Planned Implementation: Q3 2025
Make (Integromat)
- Service Purpose: Advanced automation platform and integration services
- Data Processing: Workflow automation data, integration scenarios, data transformation
- Privacy Contact: privacy@make.com
- Website: https://www.make.com
- Planned Implementation: Q3 2025
n8n
- Service Purpose: Open-source workflow automation platform
- Data Processing: Workflow configurations, automation data, custom integrations
- Website: https://n8n.io
- Planned Implementation: Q4 2025
Subprocessor Selection Criteria
PopHop carefully evaluates all subprocessors based on the following criteria:
Security Standards
- Industry-standard security certifications (SOC 2, ISO 27001, etc.)
- Comprehensive data protection and privacy policies
- Regular security audits and vulnerability assessments
- Appropriate technical and organizational measures
Legal Compliance
- Compliance with applicable data protection laws (GDPR, CCPA, etc.)
- Standard Contractual Clauses for international data transfers
- Transparent privacy practices and data handling procedures
- Appropriate data processing agreements
Business Requirements
- Reliable service delivery and uptime guarantees
- Scalable infrastructure to support platform growth
- Integration capabilities with PopHop's technical architecture
- Responsive customer support and incident management
Data Protection Measures
- Data encryption in transit and at rest
- Access controls and authentication mechanisms
- Data retention and deletion procedures
- Incident response and breach notification processes
Data Processing Activities
Categories of Data Processed
Subprocessors may process the following categories of personal data:
Identity Data:
- Names, email addresses, usernames
- Profile information and preferences
- Account authentication credentials
Community Data:
- Community participation and engagement records
- Content created and shared within communities
- Communication and messaging data
Transaction Data:
- Purchase and sale records
- Payment and billing information
- Digital product delivery data
Technical Data:
- IP addresses and device information
- Website usage and interaction data
- Performance and analytics information
Processing Purposes
Subprocessors process personal data for the following purposes:
Service Delivery:
- Platform hosting and infrastructure services
- Payment processing and financial transactions
- Communication and customer support
Performance and Analytics:
- Website performance monitoring and optimization
- User experience analysis and improvement
- Security monitoring and threat detection
Marketing and Communication:
- Email marketing and newsletter delivery
- Transactional notifications and alerts
- Customer support and help desk services
Geographic Data Processing
Primary Data Locations
- United States: Primary data processing location for most subprocessors
- European Union: Limited processing through Cloudflare and Intercom EU facilities
- Global CDN: Content delivery through Cloudflare's global network
International Transfer Safeguards
All international data transfers are protected by appropriate safeguards:
Legal Mechanisms:
- Standard Contractual Clauses (SCCs) for EU/UK transfers
- UK International Data Transfer Agreement (IDTA) for UK transfers
- Swiss Data Protection Law compliance for Swiss transfers
Technical Measures:
- End-to-end encryption for data in transit
- Data encryption at rest in all storage locations
- Access controls and authentication for all data access
Changes to Subprocessors
Notification Process
PopHop will provide customers with advance notice of subprocessor changes:
New Subprocessors:
- 30 days' advance notice before engaging new subprocessors
- Details about the new subprocessor's services and data processing
- Customer right to object to new subprocessors
Subprocessor Changes:
- Notice of material changes to existing subprocessor arrangements
- Updates to data processing activities or locations
- Changes to security measures or certifications
Customer Rights
Customers have the following rights regarding subprocessor changes:
Objection Rights:
- Right to object to new subprocessors within 30 days of notice
- Right to terminate affected services if objections cannot be resolved
- Alternative solutions where technically feasible
Information Rights:
- Access to current subprocessor information and contracts
- Details about data processing activities and security measures
- Regular updates about subprocessor compliance and certifications
Subprocessor Oversight
Due Diligence
PopHop maintains ongoing oversight of all subprocessors:
Initial Assessment:
- Security and compliance evaluation before engagement
- Review of data protection policies and procedures
- Assessment of technical and organizational measures
Ongoing Monitoring:
- Regular review of subprocessor security certifications
- Monitoring of security incidents and breach notifications
- Annual assessment of compliance and performance
Contractual Requirements
All subprocessors are bound by comprehensive data processing agreements:
Data Protection Obligations:
- Processing only on PopHop's documented instructions
- Maintaining confidentiality of all personal data
- Implementing appropriate security measures
Security Requirements:
- Industry-standard encryption and access controls
- Regular security assessments and vulnerability testing
- Incident response and breach notification procedures
Audit Rights:
- PopHop's right to audit subprocessor compliance
- Access to security documentation and certifications
- Cooperation with customer audit requests
Contact and Support
Questions About Subprocessors
For questions about our subprocessors or data processing activities:
Email: legal@pophopmail.us
Subject: Subprocessor Inquiry
Response Time: Within 2 business days
Reporting Concerns
To report concerns about subprocessor data handling:
Email: legal@pophopmail.us
Subject: Data Processing Concern
Include: Specific details about the concern and affected subprocessor
Customer Requests
For customer requests related to subprocessor data processing:
Email: legal@pophopmail.us
Subject: Customer Data Request
Include: Customer information and specific request details
Updates and Maintenance
List Maintenance
This subprocessors list is maintained and updated to reflect:
- Addition of new subprocessors with advance notice
- Changes to existing subprocessor information
- Updates to data processing activities and locations
- Changes to security certifications and compliance status
Version Control
- Current Version: 1.0 (June 18, 2025)
- Update Frequency: As needed with minimum 30 days' notice for material changes
- Customer Notification: Email alerts for significant updates
- Archive: Previous versions maintained for compliance purposes
Last Updated: June 18, 2025
This subprocessors list is maintained in accordance with PopHop's Data Processing Agreement and applicable data protection laws. We are committed to transparency about our data processing practices and the third parties we work with to provide our services.